Hello selfhosters,
I have two ip routes on my selfhosted server:
- The first and default one is routing throught my ISP router.
- The second one is a Wireguard connection that is imported and managed via Network Manager with the below options so it does not interfere with the default route.
sudo nmcli con modify wg ipv4.never-default true
sudo nmcli con modify wg ipv6.never-default true
sudo nmcli con modify wg ipv6.routes '::/0'
sudo nmcli con modify wg ipv6.route-metric 1000
I could test this setup with
curl ifconfig.me // IP from ISP
curl --interface wg ifconfig.me // IP of the VPN
Right now I would like to tell docker to create a bridge network that routes outgoing traffic from that bridge network throught the second (the VPN) route but I am struggling to do it.
I’ve tried to do this
docker network create vpn-net -o com.docker.network.host_ipv4=10.x.y.z // VPN inet obtained via ip addr show
but it does not work.
Do you have any suggestion about it ? Thank you very much!
Edit to provide more context:
Currently, what I am doing is adding network_mode: gluetun to all the containers that need to access to the internet: linkwarden, my arr stacks, qbit, IRC client, etc. This works great but it makes me paranoid because there is no isolation anymore, i.e qbit could access (or at least ping) to linkwarden’s database since they are all in the same VPN network.
Therefore, I want to have more isolation between services: each service has their own bridge network so no other container could access the resources inside that network. I am thinking about running a VPN for each service but that sounds absurd and also there are limit of 5 devices so it is quite annoying to do this.
That’s why I am asking is there anyway to tell docker bridge network to use specific host interface instead. The reason why I don’t run a machine-wide VPN is because for some services, I prefer that they have the highest network speed and doesn’t have to deal with the VPN overhead (like qbit should have their own gluetun container with its own port forwarding).
Same reason why I don’t use a macvlan or ipvlan network, because there is no isolation. Please correct me if I am wrong on this. Thank you :D
You must log in or # to comment.
I’ve never used network manager on a server and don’t understand your routing configuration, im assuming you have wg0 configured to have a default route (ip route list).
You should be able to connect a docker network to the vpn by using a macvlan insted of a bridge type network and set the parent interface of it to the wg0 interface.
docker network create -d macvlan \ --subnet=<internal vpn network>/24 \ --gateway=<gateway ip> \ -o parent=wg0 vpn-netmodified from the docker documentation
Probably also set an ip-range on the network to make the auto assigned ips not conflict with other wireguard nodes (see linked documentation).
Make sure the allowed ips in the wireguard configs are set correctly.
You can also do ipv6 like this, see the end of the linked documentation page.
Thank you very much for your reply but this is not really what I need. Please see the edit for more context :D
First off, take this for what it is: a guy who can follow instructions but does not understand all the inner workings of docker.
I use Gluetun and have a set of apps that I run through it. They are all in the same compose file. Each of the ports is defined in the Gluetun section and not with the individual app. Then each app’s network_mode is set to service:gluetun
This routes all the traffic for those apps through the VPN while maintaining my regular network for everything else.
Thank you very much for your reply but this is not really what I need. Please see the edit for more context :D
I second this. Gluetun makes it so easy, working with docker’s internal networking is such a pain.
Yep, this is exactly what I do.
This was my thought as well. Anything by that requires VPN is added to that stack and if I can bind it to the “tun” device I do - but the container requires gluten to be up.
So I got back to my server, and here’s what I do:
gluetun settings:
services: gluetun: *snip* ports: *snip* - 8090:8090 # port for qbittorrent *snip*qbittorrent (in the same compose.yml):
qbittorrent: image: linuxserver/qbittorrent:latest container_name: qbittorrent environment: *snip* - WEBUI_PORT=8090 *snip* network_mode: service:gluetun # run on the vpn network depends_on: gluetun: condition: service_healthy *snip*Also, in qbittorrent settings you can bind it to a network device. In my case it’s “tun0.” This same thing can probably be done w/ a docker network in a gluetun container and separate containers that rely on that network being up, but I haven’t looked into it. Right now, I have 2 other services that require VPN, and I’m looking at possibly 1 or 2 more. That’s pretty manageable as a single stack, I think.
